[PATCH 00/10] Provide udata helpers and use them in bnxt_re

[PATCH 00/10] Provide udata helpers and use them in bnxt_re

[Jason Gunthorpe]

Add new helpers that entirely execute the expected common patterns for
driver data uAPI forward and backwards compatibility so that drivers don't
have to open code these.

The helpers were developed by looking at the entire tree and moving every
driver to use them, but this series only converts bnxt_re as it has a
pending series to extend the driver data uAPI and the lack of correct
compatibility handling will be problematic.

This handles both the request and response side of the udata using the
following general rules:

1) The userspace can provide a longer request so long as the trailing
   part the kernel doesn't understand is all zeros.

   This provides a degree of safety if the userspace wrongly tries to use
   a new feature the kernel does not understand with some non-zero value.

   It allows a simpler rdma-core implementation because the library can
   simply always use the latest structs for the request, even if they are
   bigger. It simply has to avoid using the new members if they are not
   supported/required.

2) The userspace can provide a shorter request, the kernel will 0 pad it
   out to fill the storage. The newer kernel should understand that older
   userspace will provide 0 to new fields. The kernel has three options
   to enable new request fields:
     - Input comp_mask that says the field is supported
     - Look for non-zero values
     - Check if the udata->inlen size covers the field

   This also corrects any bugs related to not filling in request
   structures as the new helper always fully writes to the struct.

 3) The userspace can provide a shorter or longer response struct.
    If shorter the kernel reply is truncated. The kernel should be
    designed to not write to new reply field unless the userspace has
    affirmatively requested them.

    If the user buffer is longer then the kernel will zero fill it.

    Userspace has three options to enable new response fields:
      - Output comp_mask that says the field is supported
      - Look for non-zero values
      - Infer the output must be valid because the request contents demand
        it and old kernels will fail the request

Since bnxt_re has never implemented these rules correctly and now does,
provide a UCTX flag to tell userspace about it. If
BNXT_RE_UCNTX_CMASK_UAPI_COMPAT_SUPPORTED is not set then userspace must
not use any request or response fields beyond the current kernel uAPI.

Using any new fields is only possible on kernels with the flag.

A series converting all drivers to these new helpers is on github, I will
send it later:

https://github.com/jgunthorpe/linux/commits/rdma_uapi/

Jason Gunthorpe (10):
  RDMA: Add ib_copy_validate_udata_in()
  RDMA: Add ib_copy_validate_udata_in_cm()
  RDMA: Add ib_respond_udata()
  RDMA: Add ib_is_udata_in_empty()
  RDMA: Provide documentation about the uABI compatibility rules
  RDMA/bnxt_re: Add compatibility checks to the uapi path
  RDMA/bnxt_re: Add compatibility checks to the uapi path for no data
  RDMA/bnxt_re: Add missing comp_mask validation
  RDMA/bnxt_re: Use ib_respond_udata()
  RDMA/bnxt_re: Add BNXT_RE_UCNTX_CMASK_UAPI_COMPAT_SUPPORTED

 drivers/infiniband/hw/bnxt_re/ib_verbs.c |  84 +++++++---
 include/rdma/ib_verbs.h                  | 185 +++++++++++++++++++++++
 include/uapi/rdma/bnxt_re-abi.h          |   1 +
 3 files changed, 251 insertions(+), 19 deletions(-)


base-commit: aace79adb7196a02ff45a334839a4d31a0e262fb
-- 
2.43.0

[PATCH 01/10] RDMA: Add ib_copy_validate_udata_in()

[Jason Gunthorpe]

Add a new function to consolidate the required compatibility pattern for
driver data of checking against a minimum size, and checking for unknown
trailing bytes to be zero into a function.

This new function uses the faster copy_struct_from_user() instead of
trying to directly check for zero.

Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
---
 include/rdma/ib_verbs.h | 37 +++++++++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index 8bd020da774531..32dc674ef78cf1 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -3119,6 +3119,43 @@ static inline bool ib_is_udata_cleared(struct ib_udata *udata,
 	return ib_is_buffer_cleared(udata->inbuf + offset, len);
 }
 
+static inline int _ib_copy_validate_udata_in(struct ib_udata *udata, void *req,
+					     size_t kernel_size,
+					     size_t minimum_size)
+{
+	int err;
+
+	if (udata->inlen < minimum_size)
+		return -EINVAL;
+	err = copy_struct_from_user(req, kernel_size, udata->inbuf,
+				    udata->inlen);
+	if (err) {
+		if (err == E2BIG)
+			return -EOPNOTSUPP;
+		return err;
+	}
+	return 0;
+}
+
+/**
+ * ib_copy_validate_udata_in - Copy and validate that the request structure is
+ *                             compatible with this kernel
+ * @_udata: The system calls ib_udata struct
+ * @_req: The name of an on-stack structure that holds the driver data
+ * @_end_member: The member in the struct that is the original end of struct
+ *               from the first kernel to introduce it.
+ *
+ * Check that the udata input request struct is properly formed for this kernel.
+ * Then copy it into req
+ */
+#define ib_copy_validate_udata_in(_udata, _req, _end_member)              \
+	({                                                                \
+		static_assert(__same_type(*(typeof(&(_req)))0, (_req)));  \
+		_ib_copy_validate_udata_in(_udata, &(_req), sizeof(_req), \
+					   offsetofend(typeof(_req),      \
+						       _end_member));     \
+	})
+
 /**
  * ib_modify_qp_is_ok - Check that the supplied attribute mask
  * contains all required attributes and no attributes not allowed for
-- 
2.43.0

[PATCH 02/10] RDMA: Add ib_copy_validate_udata_in_cm()

[Jason Gunthorpe]

For structures with comp_mask also absorb the check of comp_mask valid
bits into the helper. This is slightly tricky because ~ might not fully
extend to 64 bits, the helper inserts an explicit type to ensure that ~
covers all bits.

Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
---
 include/rdma/ib_verbs.h | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index 32dc674ef78cf1..bb61cab2ef9a06 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -3156,6 +3156,27 @@ static inline int _ib_copy_validate_udata_in(struct ib_udata *udata, void *req,
 						       _end_member));     \
 	})
 
+/**
+ * ib_copy_validate_udata_in_cm - Copy the req structure and check the comp_mask
+ * @_udata: The system calls ib_udata struct
+ * @_req: The name of an on-stack structure that holds the driver data
+ * @_end_member: The member in the struct that is the original end of struct
+ *               from the first kernel to introduce it.
+ * @_valid_cm: A bitmask of bits permitted in the comp_mask_field.
+ *
+ * Check that the udata input request struct is properly formed for this kernel.
+ * Then copy it into req
+ */
+#define ib_copy_validate_udata_in_cm(_udata, _req, _end_member, _valid_cm)    \
+	({                                                                    \
+		typeof((_req).comp_mask) __valid_cm = _valid_cm;              \
+		int ret =                                                     \
+			ib_copy_validate_udata_in(_udata, _req, _end_member); \
+		if (!ret && (_req).comp_mask & ~__valid_cm)                   \
+			ret = -EOPNOTSUPP;                                    \
+		ret;                                                          \
+	})
+
 /**
  * ib_modify_qp_is_ok - Check that the supplied attribute mask
  * contains all required attributes and no attributes not allowed for
-- 
2.43.0

[PATCH 03/10] RDMA: Add ib_respond_udata()

[Jason Gunthorpe]

Wrap the common copy_to_user() pattern used in drivers and enhance it
to zero pad as well.

Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
---
 include/rdma/ib_verbs.h | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index bb61cab2ef9a06..c0dd82a77e7a13 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -3177,6 +3177,38 @@ static inline int _ib_copy_validate_udata_in(struct ib_udata *udata, void *req,
 		ret;                                                          \
 	})
 
+static inline int _ib_respond_udata(struct ib_udata *udata, const void *src,
+				   size_t len)
+{
+	size_t copy_len;
+
+	copy_len = min(len, udata->outlen);
+	if (copy_to_user(udata->outbuf, src, copy_len))
+		return -EFAULT;
+	if (copy_len < udata->outlen) {
+		if (clear_user(udata->outbuf + copy_len,
+			       udata->outlen - copy_len))
+			return -EFAULT;
+	}
+	return 0;
+}
+
+/**
+ * ib_respond_udata - Copy a driver data response to userspace
+ * @_udata: The system calls ib_udata struct
+ * @_rep: Kernel buffer containing the response driver data on the stack
+ *
+ * Copy driver data response structures back to userspace in a way that
+ * is forwards and backwards compatible. Longer kernel structs are truncated,
+ * userspace has made some kind of error if it needed the truncated information.
+ * Shorter structs are zero padded.
+ */
+#define ib_respond_udata(_udata, _rep)                                   \
+	({                                                               \
+		static_assert(__same_type(*(typeof(&(_rep)))0, (_rep))); \
+		_ib_respond_udata(_udata, &(_rep), sizeof(_rep));        \
+	})
+
 /**
  * ib_modify_qp_is_ok - Check that the supplied attribute mask
  * contains all required attributes and no attributes not allowed for
-- 
2.43.0

[PATCH 04/10] RDMA: Add ib_is_udata_in_empty()

[Jason Gunthorpe]

If the driver doesn't yet support any request driver data it should check
that it is all zeroed. This is a common pattern, add a helper to do this.

Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
---
 include/rdma/ib_verbs.h | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index c0dd82a77e7a13..973d9ec6875e63 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -3119,6 +3119,20 @@ static inline bool ib_is_udata_cleared(struct ib_udata *udata,
 	return ib_is_buffer_cleared(udata->inbuf + offset, len);
 }
 
+/**
+ * ib_is_udata_in_empty - Check if the udata is empty
+ * @udata: The system calls ib_udata struct
+ *
+ * This should be used if the driver does not currently define a driver data
+ * struct.
+ */
+static inline bool ib_is_udata_in_empty(struct ib_udata *udata)
+{
+	if (udata && udata->inlen != 0)
+		return ib_is_buffer_cleared(udata->inbuf, udata->inlen);
+	return true;
+}
+
 static inline int _ib_copy_validate_udata_in(struct ib_udata *udata, void *req,
 					     size_t kernel_size,
 					     size_t minimum_size)
-- 
2.43.0

[PATCH 05/10] RDMA: Provide documentation about the uABI compatibility rules

[Jason Gunthorpe]

Write down how all of this is supposed to work using the new helpers.

Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
---
 include/rdma/ib_verbs.h | 81 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 81 insertions(+)

diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index 973d9ec6875e63..0603c19bbadc4a 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -1575,6 +1575,87 @@ struct ib_uobject {
 	const struct uverbs_api_object *uapi_object;
 };
 
+/**
+ * struct ib_udata - Driver request/response data from userspace
+ * @inbuf: Pointer to request data from userspace
+ * @outbuf: Pointer to response buffer in userspace
+ * @inlen: Length of request data
+ * @outlen: Length of response buffer
+ *
+ * struct ib_udata is used to hold the driver data request and response
+ * structures defined in the uapi. They follow these rules for forwards and
+ * backwards compatibility:
+ *
+ * 1) Userspace can provide a longer request so long as the trailing part the
+ *    kernel doesn't understand is all zeros.
+ *
+ *    This provides a degree of safety if userspace wrongly tries to use a new
+ *    feature the kernel does not understand with some non-zero value.
+ *
+ *    It allows a simpler rdma-core implementation because the library can
+ *    simply always use the latest structs for the request, even if they are
+ *    bigger. It simply has to avoid using the new members if they are not
+ *    supported/required.
+ *
+ * 2) Userspace can provide a shorter request; the kernel will zero-pad it out
+ *    to fill the storage. The newer kernel should understand that older
+ *    userspace will provide 0 to new fields. The kernel has three options to
+ *    enable new request fields:
+ *
+ *    - Input comp_mask that says the field is supported
+ *    - Look for non-zero values
+ *    - Check if the udata->inlen size covers the field
+ *
+ *    This also corrects any bugs related to not filling in request structures
+ *    as the new helper always fully writes to the struct.
+ *
+ * 3) Userspace can provide a shorter or longer response struct. If shorter,
+ *    the kernel reply is truncated. The kernel should be designed to not write
+ *    to new reply fields unless userspace has affirmatively requested them.
+ *
+ *    If the user buffer is longer, the kernel will zero-fill it.
+ *
+ *    Userspace has three options to enable new response fields:
+ *
+ *    - Output comp_mask that says the field is supported
+ *    - Look for non-zero values
+ *    - Infer the output must be valid because the request contents demand it
+ *      and old kernels will fail the request
+ *
+ * The following helper functions implement these semantics:
+ *
+ * ib_copy_validate_udata_in() - Checks the minimum length, and zero trailing::
+ *
+ *     struct driver_create_cq_req req;
+ *     int err;
+ *
+ *     err = ib_copy_validate_udata_in(udata, req, end_member);
+ *     if (err)
+ *         return err;
+ *
+ * The third argument specifies the last member of the struct in the first
+ * kernel version that introduced it, establishing the minimum required size.
+ *
+ * ib_copy_validate_udata_in_cm() - The above but also validate a
+ * comp_mask member only has supported bits set:
+ *
+ *     err = ib_copy_validate_udata_in_cm(udata, req, first_version_last_member,
+ *                                        DRIVER_CREATE_CQ_MASK_FEATURE_A |
+ *                                        DRIVER_CREATE_CQ_MASK_FEATURE_B);
+ *
+ * ib_respond_udata() - Implements the response rules::
+ *
+ *     struct driver_create_cq_resp resp = {};
+ *
+ *     resp.some_field = value;
+ *     return ib_respond_udata(udata, resp);
+ *
+ * ib_is_udata_in_empty() - Used instead of ib_copy_validate_udata_in() if the
+ * driver does not have a request structure:
+ *
+ *     if (!ib_is_udata_in_empty(udata))
+ *         return -EOPNOTSUPP;
+ */
 struct ib_udata {
 	const void __user *inbuf;
 	void __user *outbuf;
-- 
2.43.0

[PATCH 06/10] RDMA/bnxt_re: Add compatibility checks to the uapi path

[Jason Gunthorpe]

Check that the driver data is properly sized and properly zeroed by
calling ib_copy_validate_udata_in().

Use git history to find the commit introducing each req struct and use
that to select the end member.

Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
---
 drivers/infiniband/hw/bnxt_re/ib_verbs.c | 29 +++++++++++++-----------
 1 file changed, 16 insertions(+), 13 deletions(-)

diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
index f19b55c13d5809..2942ff44f6a547 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
@@ -1655,9 +1655,11 @@ int bnxt_re_create_qp(struct ib_qp *ib_qp, struct ib_qp_init_attr *qp_init_attr,
 	qp = container_of(ib_qp, struct bnxt_re_qp, ib_qp);
 
 	uctx = rdma_udata_to_drv_context(udata, struct bnxt_re_ucontext, ib_uctx);
-	if (udata)
-		if (ib_copy_from_udata(&ureq, udata,  min(udata->inlen, sizeof(ureq))))
-			return -EFAULT;
+	if (udata) {
+		rc = ib_copy_validate_udata_in(udata, ureq, qp_handle);
+		if (rc)
+			return rc;
+	}
 
 	rc = bnxt_re_test_qp_limits(rdev, qp_init_attr, dev_attr);
 	if (!rc) {
@@ -1847,9 +1849,11 @@ static int bnxt_re_init_user_srq(struct bnxt_re_dev *rdev,
 	int bytes = 0;
 	struct bnxt_re_ucontext *cntx = rdma_udata_to_drv_context(
 		udata, struct bnxt_re_ucontext, ib_uctx);
+	int rc;
 
-	if (ib_copy_from_udata(&ureq, udata, sizeof(ureq)))
-		return -EFAULT;
+	rc = ib_copy_validate_udata_in(udata, ureq, srq_handle);
+	if (rc)
+		return rc;
 
 	bytes = (qplib_srq->max_wqe * qplib_srq->wqe_size);
 	bytes = PAGE_ALIGN(bytes);
@@ -3156,10 +3160,10 @@ int bnxt_re_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr,
 	cq->qplib_cq.sg_info.pgshft = PAGE_SHIFT;
 	if (udata) {
 		struct bnxt_re_cq_req req;
-		if (ib_copy_from_udata(&req, udata, sizeof(req))) {
-			rc = -EFAULT;
+
+		rc = ib_copy_validate_udata_in(udata, req, cq_handle);
+		if (rc)
 			goto fail;
-		}
 
 		cq->umem = ib_umem_get(&rdev->ibdev, req.cq_va,
 				       entries * sizeof(struct cq_base),
@@ -3289,10 +3293,9 @@ int bnxt_re_resize_cq(struct ib_cq *ibcq, int cqe, struct ib_udata *udata)
 		entries = dev_attr->max_cq_wqes + 1;
 
 	/* uverbs consumer */
-	if (ib_copy_from_udata(&req, udata, sizeof(req))) {
-		rc = -EFAULT;
+	rc = ib_copy_validate_udata_in(udata, req, cq_va);
+	if (rc)
 		goto fail;
-	}
 
 	cq->resize_umem = ib_umem_get(&rdev->ibdev, req.cq_va,
 				      entries * sizeof(struct cq_base),
@@ -4391,8 +4394,8 @@ int bnxt_re_alloc_ucontext(struct ib_ucontext *ctx, struct ib_udata *udata)
 	if (_is_host_msn_table(rdev->qplib_res.dattr->dev_cap_flags2))
 		resp.comp_mask |= BNXT_RE_UCNTX_CMASK_MSN_TABLE_ENABLED;
 
-	if (udata->inlen >= sizeof(ureq)) {
-		rc = ib_copy_from_udata(&ureq, udata, min(udata->inlen, sizeof(ureq)));
+	if (udata->inlen) {
+		rc = ib_copy_validate_udata_in(udata, ureq, comp_mask);
 		if (rc)
 			goto cfail;
 		if (ureq.comp_mask & BNXT_RE_COMP_MASK_REQ_UCNTX_POW2_SUPPORT) {
-- 
2.43.0

[PATCH 07/10] RDMA/bnxt_re: Add compatibility checks to the uapi path for no data

[Jason Gunthorpe]

If drivers ever want to go from an empty drvdata to something with them
they need to have called ib_is_udata_in_empty(). Add the missing calls to
all the system calls that don't have req structures.

Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
---
 drivers/infiniband/hw/bnxt_re/ib_verbs.c | 39 ++++++++++++++++++++++++
 1 file changed, 39 insertions(+)

diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
index 2942ff44f6a547..485785fad1df63 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
@@ -187,6 +187,9 @@ int bnxt_re_query_device(struct ib_device *ibdev,
 	struct bnxt_re_dev *rdev = to_bnxt_re_dev(ibdev, ibdev);
 	struct bnxt_qplib_dev_attr *dev_attr = rdev->dev_attr;
 
+	if (!ib_is_udata_in_empty(udata))
+		return -EOPNOTSUPP;
+
 	memset(ib_attr, 0, sizeof(*ib_attr));
 	memcpy(&ib_attr->fw_ver, dev_attr->fw_ver,
 	       min(sizeof(dev_attr->fw_ver),
@@ -676,6 +679,9 @@ int bnxt_re_dealloc_pd(struct ib_pd *ib_pd, struct ib_udata *udata)
 	struct bnxt_re_pd *pd = container_of(ib_pd, struct bnxt_re_pd, ib_pd);
 	struct bnxt_re_dev *rdev = pd->rdev;
 
+	if (!ib_is_udata_in_empty(udata))
+		return -EOPNOTSUPP;
+
 	if (udata) {
 		rdma_user_mmap_entry_remove(pd->pd_db_mmap);
 		pd->pd_db_mmap = NULL;
@@ -703,6 +709,9 @@ int bnxt_re_alloc_pd(struct ib_pd *ibpd, struct ib_udata *udata)
 	u32 active_pds;
 	int rc = 0;
 
+	if (!ib_is_udata_in_empty(udata))
+		return -EOPNOTSUPP;
+
 	pd->rdev = rdev;
 	if (bnxt_qplib_alloc_pd(&rdev->qplib_res, &pd->qplib_pd)) {
 		ibdev_err(&rdev->ibdev, "Failed to allocate HW PD");
@@ -817,6 +826,9 @@ int bnxt_re_create_ah(struct ib_ah *ib_ah, struct rdma_ah_init_attr *init_attr,
 	u8 nw_type;
 	int rc;
 
+	if (!ib_is_udata_in_empty(udata))
+		return -EOPNOTSUPP;
+
 	if (!(rdma_ah_get_ah_flags(ah_attr) & IB_AH_GRH)) {
 		ibdev_err(&rdev->ibdev, "Failed to alloc AH: GRH not set");
 		return -EINVAL;
@@ -978,6 +990,9 @@ int bnxt_re_destroy_qp(struct ib_qp *ib_qp, struct ib_udata *udata)
 	unsigned int flags;
 	int rc;
 
+	if (!ib_is_udata_in_empty(udata))
+		return -EOPNOTSUPP;
+
 	bnxt_re_debug_rem_qpinfo(rdev, qp);
 
 	bnxt_qplib_flush_cqn_wq(&qp->qplib_qp);
@@ -1828,6 +1843,9 @@ int bnxt_re_destroy_srq(struct ib_srq *ib_srq, struct ib_udata *udata)
 	struct bnxt_re_dev *rdev = srq->rdev;
 	struct bnxt_qplib_srq *qplib_srq = &srq->qplib_srq;
 
+	if (!ib_is_udata_in_empty(udata))
+		return -EOPNOTSUPP;
+
 	if (rdev->chip_ctx->modes.toggle_bits & BNXT_QPLIB_SRQ_TOGGLE_BIT) {
 		free_page((unsigned long)srq->uctx_srq_page);
 		hash_del(&srq->hash_entry);
@@ -1977,6 +1995,9 @@ int bnxt_re_modify_srq(struct ib_srq *ib_srq, struct ib_srq_attr *srq_attr,
 					       ib_srq);
 	struct bnxt_re_dev *rdev = srq->rdev;
 
+	if (!ib_is_udata_in_empty(udata))
+		return -EOPNOTSUPP;
+
 	switch (srq_attr_mask) {
 	case IB_SRQ_MAX_WR:
 		/* SRQ resize is not supported */
@@ -2093,6 +2114,9 @@ int bnxt_re_modify_qp(struct ib_qp *ib_qp, struct ib_qp_attr *qp_attr,
 	unsigned int flags;
 	u8 nw_type;
 
+	if (!ib_is_udata_in_empty(udata))
+		return -EOPNOTSUPP;
+
 	if (qp_attr_mask & ~IB_QP_ATTR_STANDARD_BITS)
 		return -EOPNOTSUPP;
 
@@ -3111,6 +3135,9 @@ int bnxt_re_destroy_cq(struct ib_cq *ib_cq, struct ib_udata *udata)
 	nq = cq->qplib_cq.nq;
 	cctx = rdev->chip_ctx;
 
+	if (!ib_is_udata_in_empty(udata))
+		return -EOPNOTSUPP;
+
 	if (cctx->modes.toggle_bits & BNXT_QPLIB_CQ_TOGGLE_BIT) {
 		free_page((unsigned long)cq->uctx_cq_page);
 		hash_del(&cq->hash_entry);
@@ -4058,6 +4085,9 @@ int bnxt_re_dereg_mr(struct ib_mr *ib_mr, struct ib_udata *udata)
 	struct bnxt_re_dev *rdev = mr->rdev;
 	int rc;
 
+	if (!ib_is_udata_in_empty(udata))
+		return -EOPNOTSUPP;
+
 	rc = bnxt_qplib_free_mrw(&rdev->qplib_res, &mr->qplib_mr);
 	if (rc) {
 		ibdev_err(&rdev->ibdev, "Dereg MR failed: %#x\n", rc);
@@ -4166,6 +4196,9 @@ struct ib_mw *bnxt_re_alloc_mw(struct ib_pd *ib_pd, enum ib_mw_type type,
 	u32 active_mws;
 	int rc;
 
+	if (!ib_is_udata_in_empty(udata))
+		return ERR_PTR(-EOPNOTSUPP);
+
 	mw = kzalloc(sizeof(*mw), GFP_KERNEL);
 	if (!mw)
 		return ERR_PTR(-ENOMEM);
@@ -4294,6 +4327,9 @@ struct ib_mr *bnxt_re_reg_user_mr(struct ib_pd *ib_pd, u64 start, u64 length,
 	struct ib_umem *umem;
 	struct ib_mr *ib_mr;
 
+	if (!ib_is_udata_in_empty(udata))
+		return ERR_PTR(-EOPNOTSUPP);
+
 	if (dmah)
 		return ERR_PTR(-EOPNOTSUPP);
 
@@ -4474,6 +4510,9 @@ struct ib_flow *bnxt_re_create_flow(struct ib_qp *ib_qp,
 	struct bnxt_re_flow *flow;
 	int rc;
 
+	if (!ib_is_udata_in_empty(udata))
+		return ERR_PTR(-EOPNOTSUPP);
+
 	if (attr->type != IB_FLOW_ATTR_SNIFFER ||
 	    !rdev->rcfw.roce_mirror)
 		return ERR_PTR(-EOPNOTSUPP);
-- 
2.43.0

[PATCH 08/10] RDMA/bnxt_re: Add missing comp_mask validation

[Jason Gunthorpe]

Two existing req driver data structures have comp_mask but nothing
checks them for valid contents. Add the missing checks.

Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
---
 drivers/infiniband/hw/bnxt_re/ib_verbs.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
index 485785fad1df63..6ea03e1f6c23dd 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
@@ -1671,7 +1671,7 @@ int bnxt_re_create_qp(struct ib_qp *ib_qp, struct ib_qp_init_attr *qp_init_attr,
 
 	uctx = rdma_udata_to_drv_context(udata, struct bnxt_re_ucontext, ib_uctx);
 	if (udata) {
-		rc = ib_copy_validate_udata_in(udata, ureq, qp_handle);
+		rc = ib_copy_validate_udata_in_cm(udata, ureq, qp_handle, 0);
 		if (rc)
 			return rc;
 	}
@@ -4431,7 +4431,10 @@ int bnxt_re_alloc_ucontext(struct ib_ucontext *ctx, struct ib_udata *udata)
 		resp.comp_mask |= BNXT_RE_UCNTX_CMASK_MSN_TABLE_ENABLED;
 
 	if (udata->inlen) {
-		rc = ib_copy_validate_udata_in(udata, ureq, comp_mask);
+		rc = ib_copy_validate_udata_in_cm(
+			udata, ureq, comp_mask,
+			BNXT_RE_COMP_MASK_REQ_UCNTX_POW2_SUPPORT |
+				BNXT_RE_COMP_MASK_REQ_UCNTX_VAR_WQE_SUPPORT);
 		if (rc)
 			goto cfail;
 		if (ureq.comp_mask & BNXT_RE_COMP_MASK_REQ_UCNTX_POW2_SUPPORT) {
-- 
2.43.0

[PATCH 09/10] RDMA/bnxt_re: Use ib_respond_udata()

[Jason Gunthorpe]

All the calls to ib_copy_to_udata() can use this helper safely.

Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
---
 drivers/infiniband/hw/bnxt_re/ib_verbs.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
index 6ea03e1f6c23dd..9d1c31bb994218 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
@@ -748,7 +748,7 @@ int bnxt_re_alloc_pd(struct ib_pd *ibpd, struct ib_udata *udata)
 
 		pd->pd_db_mmap = &entry->rdma_entry;
 
-		rc = ib_copy_to_udata(udata, &resp, min(sizeof(resp), udata->outlen));
+		rc = ib_respond_udata(udata, resp);
 		if (rc) {
 			rdma_user_mmap_entry_remove(pd->pd_db_mmap);
 			rc = -EFAULT;
@@ -1705,7 +1705,7 @@ int bnxt_re_create_qp(struct ib_qp *ib_qp, struct ib_qp_init_attr *qp_init_attr,
 
 			resp.qpid = qp->qplib_qp.id;
 			resp.rsvd = 0;
-			rc = ib_copy_to_udata(udata, &resp, sizeof(resp));
+			rc = ib_respond_udata(udata, resp);
 			if (rc) {
 				ibdev_err(&rdev->ibdev, "Failed to copy QP udata");
 				goto qp_destroy;
@@ -1966,7 +1966,7 @@ int bnxt_re_create_srq(struct ib_srq *ib_srq,
 			}
 			resp.comp_mask |= BNXT_RE_SRQ_TOGGLE_PAGE_SUPPORT;
 		}
-		rc = ib_copy_to_udata(udata, &resp, sizeof(resp));
+		rc = ib_respond_udata(udata, resp);
 		if (rc) {
 			ibdev_err(&rdev->ibdev, "SRQ copy to udata failed!");
 			bnxt_qplib_destroy_srq(&rdev->qplib_res,
@@ -3248,7 +3248,7 @@ int bnxt_re_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr,
 		resp.tail = cq->qplib_cq.hwq.cons;
 		resp.phase = cq->qplib_cq.period;
 		resp.rsvd = 0;
-		rc = ib_copy_to_udata(udata, &resp, min(sizeof(resp), udata->outlen));
+		rc = ib_respond_udata(udata, resp);
 		if (rc) {
 			ibdev_err(&rdev->ibdev, "Failed to copy CQ udata");
 			bnxt_qplib_destroy_cq(&rdev->qplib_res, &cq->qplib_cq);
@@ -4449,7 +4449,7 @@ int bnxt_re_alloc_ucontext(struct ib_ucontext *ctx, struct ib_udata *udata)
 		}
 	}
 
-	rc = ib_copy_to_udata(udata, &resp, min(udata->outlen, sizeof(resp)));
+	rc = ib_respond_udata(udata, resp);
 	if (rc) {
 		ibdev_err(ibdev, "Failed to copy user context");
 		rc = -EFAULT;
-- 
2.43.0

[PATCH 10/10] RDMA/bnxt_re: Add BNXT_RE_UCNTX_CMASK_UAPI_COMPAT_SUPPORTED

[Jason Gunthorpe]

Now that the driver properly implements the uAPI forwards and backwards
compatibility checks tell userspace about it.

If this flag is not set the userspace may not use any of the uAPI newer
than this commit as it will behave in unexpected ways on older kernels
that lack validation.

Userspace should test this flag before invoking any future enhanced calls
relying on changes to the driver data.

Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
---
 drivers/infiniband/hw/bnxt_re/ib_verbs.c | 3 ++-
 include/uapi/rdma/bnxt_re-abi.h          | 1 +
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
index 9d1c31bb994218..1b3a4fca868fce 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
@@ -4401,7 +4401,8 @@ int bnxt_re_alloc_ucontext(struct ib_ucontext *ctx, struct ib_udata *udata)
 	}
 	spin_lock_init(&uctx->sh_lock);
 
-	resp.comp_mask = BNXT_RE_UCNTX_CMASK_HAVE_CCTX;
+	resp.comp_mask = BNXT_RE_UCNTX_CMASK_HAVE_CCTX |
+			 BNXT_RE_UCNTX_CMASK_UAPI_COMPAT_SUPPORTED;
 	chip_met_rev_num = rdev->chip_ctx->chip_num;
 	chip_met_rev_num |= ((u32)rdev->chip_ctx->chip_rev & 0xFF) <<
 			     BNXT_RE_CHIP_ID0_CHIP_REV_SFT;
diff --git a/include/uapi/rdma/bnxt_re-abi.h b/include/uapi/rdma/bnxt_re-abi.h
index faa9d62b3b3091..f8162438e14e98 100644
--- a/include/uapi/rdma/bnxt_re-abi.h
+++ b/include/uapi/rdma/bnxt_re-abi.h
@@ -56,6 +56,7 @@ enum {
 	BNXT_RE_UCNTX_CMASK_DBR_PACING_ENABLED = 0x08ULL,
 	BNXT_RE_UCNTX_CMASK_POW2_DISABLED = 0x10ULL,
 	BNXT_RE_UCNTX_CMASK_MSN_TABLE_ENABLED = 0x40,
+	BNXT_RE_UCNTX_CMASK_UAPI_COMPAT_SUPPORTED = 0x80,
 };
 
 enum bnxt_re_wqe_mode {
-- 
2.43.0

Re: [PATCH 00/10] Provide udata helpers and use them in bnxt_re

[Sriharsha Basavapatna]

[-- Attachment #1: Type: text/plain, Size: 4218 bytes --]

On Fri, Feb 6, 2026 at 7:15 AM Jason Gunthorpe <jgg@nvidia.com> wrote:
>
> Add new helpers that entirely execute the expected common patterns for
> driver data uAPI forward and backwards compatibility so that drivers don't
> have to open code these.
>
> The helpers were developed by looking at the entire tree and moving every
> driver to use them, but this series only converts bnxt_re as it has a
> pending series to extend the driver data uAPI and the lack of correct
> compatibility handling will be problematic.
>
> This handles both the request and response side of the udata using the
> following general rules:
>
> 1) The userspace can provide a longer request so long as the trailing
>    part the kernel doesn't understand is all zeros.
>
>    This provides a degree of safety if the userspace wrongly tries to use
>    a new feature the kernel does not understand with some non-zero value.
>
>    It allows a simpler rdma-core implementation because the library can
>    simply always use the latest structs for the request, even if they are
>    bigger. It simply has to avoid using the new members if they are not
>    supported/required.
>
> 2) The userspace can provide a shorter request, the kernel will 0 pad it
>    out to fill the storage. The newer kernel should understand that older
>    userspace will provide 0 to new fields. The kernel has three options
>    to enable new request fields:
>      - Input comp_mask that says the field is supported
>      - Look for non-zero values
>      - Check if the udata->inlen size covers the field
>
>    This also corrects any bugs related to not filling in request
>    structures as the new helper always fully writes to the struct.
>
>  3) The userspace can provide a shorter or longer response struct.
>     If shorter the kernel reply is truncated. The kernel should be
>     designed to not write to new reply field unless the userspace has
>     affirmatively requested them.
>
>     If the user buffer is longer then the kernel will zero fill it.
>
>     Userspace has three options to enable new response fields:
>       - Output comp_mask that says the field is supported
>       - Look for non-zero values
>       - Infer the output must be valid because the request contents demand
>         it and old kernels will fail the request
>
> Since bnxt_re has never implemented these rules correctly and now does,
> provide a UCTX flag to tell userspace about it. If
> BNXT_RE_UCNTX_CMASK_UAPI_COMPAT_SUPPORTED is not set then userspace must
> not use any request or response fields beyond the current kernel uAPI.
>
> Using any new fields is only possible on kernels with the flag.
>
> A series converting all drivers to these new helpers is on github, I will
> send it later:
>
> https://github.com/jgunthorpe/linux/commits/rdma_uapi/
>
> Jason Gunthorpe (10):
>   RDMA: Add ib_copy_validate_udata_in()
>   RDMA: Add ib_copy_validate_udata_in_cm()
>   RDMA: Add ib_respond_udata()
>   RDMA: Add ib_is_udata_in_empty()
>   RDMA: Provide documentation about the uABI compatibility rules
>   RDMA/bnxt_re: Add compatibility checks to the uapi path
>   RDMA/bnxt_re: Add compatibility checks to the uapi path for no data
>   RDMA/bnxt_re: Add missing comp_mask validation
>   RDMA/bnxt_re: Use ib_respond_udata()
>   RDMA/bnxt_re: Add BNXT_RE_UCNTX_CMASK_UAPI_COMPAT_SUPPORTED
>
>  drivers/infiniband/hw/bnxt_re/ib_verbs.c |  84 +++++++---
>  include/rdma/ib_verbs.h                  | 185 +++++++++++++++++++++++
>  include/uapi/rdma/bnxt_re-abi.h          |   1 +
>  3 files changed, 251 insertions(+), 19 deletions(-)
>
>
> base-commit: aace79adb7196a02ff45a334839a4d31a0e262fb
> --
> 2.43.0
>

Thanks for this patch series. Patches 6, 7, 8 and 10 failed to apply
cleanly, due to conflicts with the recently merged QP rate limit
patchset in bnxt_re.  So please rebase it.
I applied this series, + QP-dmabuf devop patch, + bnxt_re DV series
and tested it.  It worked fine.

For the series:
Acked-by: Sriharsha Basavapatna <sriharsha.basavapatna@broadcom.com>
Tested-by: Sriharsha Basavapatna <sriharsha.basavapatna@broadcom.com>

Thanks,
-Harsha

[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 5505 bytes --]

Re: [PATCH 00/10] Provide udata helpers and use them in bnxt_re

[Jason Gunthorpe]

On Fri, Feb 06, 2026 at 05:50:07PM +0530, Sriharsha Basavapatna wrote:
> Thanks for this patch series. Patches 6, 7, 8 and 10 failed to apply
> cleanly, due to conflicts with the recently merged QP rate limit
> patchset in bnxt_re.  So please rebase it.
> I applied this series, + QP-dmabuf devop patch, + bnxt_re DV series
> and tested it.  It worked fine.

Okay, I updated the github branches and we can do this first thing
next merge window. If you send out just the DBR and revised more
trivial CQ changes for the other series they can likely be picked up
immediately on rc1 too. Then you can work on figuring out QP.

Jason

Re: [PATCH 06/10] RDMA/bnxt_re: Add compatibility checks to the uapi path

[Zhu Yanjun]

在 2026/2/5 17:45, Jason Gunthorpe 写道:
> Check that the driver data is properly sized and properly zeroed by
> calling ib_copy_validate_udata_in().
> 
> Use git history to find the commit introducing each req struct and use
> that to select the end member.
> 
> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>

Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>

Zhu Yanjun

> ---
>   drivers/infiniband/hw/bnxt_re/ib_verbs.c | 29 +++++++++++++-----------
>   1 file changed, 16 insertions(+), 13 deletions(-)
> 
> diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> index f19b55c13d5809..2942ff44f6a547 100644
> --- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> +++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> @@ -1655,9 +1655,11 @@ int bnxt_re_create_qp(struct ib_qp *ib_qp, struct ib_qp_init_attr *qp_init_attr,
>   	qp = container_of(ib_qp, struct bnxt_re_qp, ib_qp);
>   
>   	uctx = rdma_udata_to_drv_context(udata, struct bnxt_re_ucontext, ib_uctx);
> -	if (udata)
> -		if (ib_copy_from_udata(&ureq, udata,  min(udata->inlen, sizeof(ureq))))
> -			return -EFAULT;
> +	if (udata) {
> +		rc = ib_copy_validate_udata_in(udata, ureq, qp_handle);
> +		if (rc)
> +			return rc;
> +	}
>   
>   	rc = bnxt_re_test_qp_limits(rdev, qp_init_attr, dev_attr);
>   	if (!rc) {
> @@ -1847,9 +1849,11 @@ static int bnxt_re_init_user_srq(struct bnxt_re_dev *rdev,
>   	int bytes = 0;
>   	struct bnxt_re_ucontext *cntx = rdma_udata_to_drv_context(
>   		udata, struct bnxt_re_ucontext, ib_uctx);
> +	int rc;
>   
> -	if (ib_copy_from_udata(&ureq, udata, sizeof(ureq)))
> -		return -EFAULT;
> +	rc = ib_copy_validate_udata_in(udata, ureq, srq_handle);
> +	if (rc)
> +		return rc;
>   
>   	bytes = (qplib_srq->max_wqe * qplib_srq->wqe_size);
>   	bytes = PAGE_ALIGN(bytes);
> @@ -3156,10 +3160,10 @@ int bnxt_re_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr,
>   	cq->qplib_cq.sg_info.pgshft = PAGE_SHIFT;
>   	if (udata) {
>   		struct bnxt_re_cq_req req;
> -		if (ib_copy_from_udata(&req, udata, sizeof(req))) {
> -			rc = -EFAULT;
> +
> +		rc = ib_copy_validate_udata_in(udata, req, cq_handle);
> +		if (rc)
>   			goto fail;
> -		}
>   
>   		cq->umem = ib_umem_get(&rdev->ibdev, req.cq_va,
>   				       entries * sizeof(struct cq_base),
> @@ -3289,10 +3293,9 @@ int bnxt_re_resize_cq(struct ib_cq *ibcq, int cqe, struct ib_udata *udata)
>   		entries = dev_attr->max_cq_wqes + 1;
>   
>   	/* uverbs consumer */
> -	if (ib_copy_from_udata(&req, udata, sizeof(req))) {
> -		rc = -EFAULT;
> +	rc = ib_copy_validate_udata_in(udata, req, cq_va);
> +	if (rc)
>   		goto fail;
> -	}
>   
>   	cq->resize_umem = ib_umem_get(&rdev->ibdev, req.cq_va,
>   				      entries * sizeof(struct cq_base),
> @@ -4391,8 +4394,8 @@ int bnxt_re_alloc_ucontext(struct ib_ucontext *ctx, struct ib_udata *udata)
>   	if (_is_host_msn_table(rdev->qplib_res.dattr->dev_cap_flags2))
>   		resp.comp_mask |= BNXT_RE_UCNTX_CMASK_MSN_TABLE_ENABLED;
>   
> -	if (udata->inlen >= sizeof(ureq)) {
> -		rc = ib_copy_from_udata(&ureq, udata, min(udata->inlen, sizeof(ureq)));
> +	if (udata->inlen) {
> +		rc = ib_copy_validate_udata_in(udata, ureq, comp_mask);
>   		if (rc)
>   			goto cfail;
>   		if (ureq.comp_mask & BNXT_RE_COMP_MASK_REQ_UCNTX_POW2_SUPPORT) {

Re: [PATCH 01/10] RDMA: Add ib_copy_validate_udata_in()

[Junxian Huang]

On 2026/2/6 9:45, Jason Gunthorpe wrote:
> Add a new function to consolidate the required compatibility pattern for
> driver data of checking against a minimum size, and checking for unknown
> trailing bytes to be zero into a function.
> 
> This new function uses the faster copy_struct_from_user() instead of
> trying to directly check for zero.
> 
> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
> ---
>  include/rdma/ib_verbs.h | 37 +++++++++++++++++++++++++++++++++++++
>  1 file changed, 37 insertions(+)
> 
> diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
> index 8bd020da774531..32dc674ef78cf1 100644
> --- a/include/rdma/ib_verbs.h
> +++ b/include/rdma/ib_verbs.h
> @@ -3119,6 +3119,43 @@ static inline bool ib_is_udata_cleared(struct ib_udata *udata,
>  	return ib_is_buffer_cleared(udata->inbuf + offset, len);
>  }
>  
> +static inline int _ib_copy_validate_udata_in(struct ib_udata *udata, void *req,
> +					     size_t kernel_size,
> +					     size_t minimum_size)
> +{
> +	int err;
> +
> +	if (udata->inlen < minimum_size)
> +		return -EINVAL;
> +	err = copy_struct_from_user(req, kernel_size, udata->inbuf,
> +				    udata->inlen);
> +	if (err) {
> +		if (err == E2BIG)

The E2BIG should be negative.

> +			return -EOPNOTSUPP;
> +		return err;
> +	}
> +	return 0;

The logic here can be simplified like this:

err = copy_struct_from_user(req, kernel_size, udata->inbuf,
			    udata->inlen);
if (err == -E2BIG)
	return -EOPNOTSUPP;
return err;

Junxian

> +}
> +
> +/**
> + * ib_copy_validate_udata_in - Copy and validate that the request structure is
> + *                             compatible with this kernel
> + * @_udata: The system calls ib_udata struct
> + * @_req: The name of an on-stack structure that holds the driver data
> + * @_end_member: The member in the struct that is the original end of struct
> + *               from the first kernel to introduce it.
> + *
> + * Check that the udata input request struct is properly formed for this kernel.
> + * Then copy it into req
> + */
> +#define ib_copy_validate_udata_in(_udata, _req, _end_member)              \
> +	({                                                                \
> +		static_assert(__same_type(*(typeof(&(_req)))0, (_req)));  \
> +		_ib_copy_validate_udata_in(_udata, &(_req), sizeof(_req), \
> +					   offsetofend(typeof(_req),      \
> +						       _end_member));     \
> +	})
> +
>  /**
>   * ib_modify_qp_is_ok - Check that the supplied attribute mask
>   * contains all required attributes and no attributes not allowed for

Re: [PATCH 00/10] Provide udata helpers and use them in bnxt_re

[Sriharsha Basavapatna]

[-- Attachment #1: Type: text/plain, Size: 863 bytes --]

On Sat, Feb 7, 2026 at 12:41 AM Jason Gunthorpe <jgg@nvidia.com> wrote:
>
> On Fri, Feb 06, 2026 at 05:50:07PM +0530, Sriharsha Basavapatna wrote:
> > Thanks for this patch series. Patches 6, 7, 8 and 10 failed to apply
> > cleanly, due to conflicts with the recently merged QP rate limit
> > patchset in bnxt_re.  So please rebase it.
> > I applied this series, + QP-dmabuf devop patch, + bnxt_re DV series
> > and tested it.  It worked fine.
>
> Okay, I updated the github branches and we can do this first thing
> next merge window. If you send out just the DBR and revised more
> trivial CQ changes for the other series they can likely be picked up
> immediately on rc1 too. Then you can work on figuring out QP.
>
> Jason
I'm working on the DBR and CQ changes, I should send it out for review
in the next couple of days.
Thanks,
-Harsha

[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 5505 bytes --]

Re: [PATCH 01/10] RDMA: Add ib_copy_validate_udata_in()

[Jason Gunthorpe]

On Mon, Feb 09, 2026 at 02:11:32PM +0800, Junxian Huang wrote:

> > +static inline int _ib_copy_validate_udata_in(struct ib_udata *udata, void *req,
> > +					     size_t kernel_size,
> > +					     size_t minimum_size)
> > +{
> > +	int err;
> > +
> > +	if (udata->inlen < minimum_size)
> > +		return -EINVAL;
> > +	err = copy_struct_from_user(req, kernel_size, udata->inbuf,
> > +				    udata->inlen);
> > +	if (err) {
> > +		if (err == E2BIG)
> 
> The E2BIG should be negative.

Oops, thanks!!

Jason

Re: [PATCH 03/10] RDMA: Add ib_respond_udata()

[Leon Romanovsky]

On Thu, Feb 05, 2026 at 09:45:37PM -0400, Jason Gunthorpe wrote:
> Wrap the common copy_to_user() pattern used in drivers and enhance it
> to zero pad as well.
> 
> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
> ---
>  include/rdma/ib_verbs.h | 32 ++++++++++++++++++++++++++++++++
>  1 file changed, 32 insertions(+)
> 
> diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
> index bb61cab2ef9a06..c0dd82a77e7a13 100644
> --- a/include/rdma/ib_verbs.h
> +++ b/include/rdma/ib_verbs.h
> @@ -3177,6 +3177,38 @@ static inline int _ib_copy_validate_udata_in(struct ib_udata *udata, void *req,
>  		ret;                                                          \
>  	})
>  
> +static inline int _ib_respond_udata(struct ib_udata *udata, const void *src,
> +				   size_t len)
> +{
> +	size_t copy_len;
> +
> +	copy_len = min(len, udata->outlen);

Don't you need to check that udata->outlen is larger than zero?

Thanks

> +	if (copy_to_user(udata->outbuf, src, copy_len))
> +		return -EFAULT;
> +	if (copy_len < udata->outlen) {
> +		if (clear_user(udata->outbuf + copy_len,
> +			       udata->outlen - copy_len))
> +			return -EFAULT;
> +	}
> +	return 0;
> +}
> +
> +/**
> + * ib_respond_udata - Copy a driver data response to userspace
> + * @_udata: The system calls ib_udata struct
> + * @_rep: Kernel buffer containing the response driver data on the stack
> + *
> + * Copy driver data response structures back to userspace in a way that
> + * is forwards and backwards compatible. Longer kernel structs are truncated,
> + * userspace has made some kind of error if it needed the truncated information.
> + * Shorter structs are zero padded.
> + */
> +#define ib_respond_udata(_udata, _rep)                                   \
> +	({                                                               \
> +		static_assert(__same_type(*(typeof(&(_rep)))0, (_rep))); \
> +		_ib_respond_udata(_udata, &(_rep), sizeof(_rep));        \
> +	})
> +
>  /**
>   * ib_modify_qp_is_ok - Check that the supplied attribute mask
>   * contains all required attributes and no attributes not allowed for
> -- 
> 2.43.0
> 
> 

Re: [PATCH 04/10] RDMA: Add ib_is_udata_in_empty()

[Leon Romanovsky]

On Thu, Feb 05, 2026 at 09:45:38PM -0400, Jason Gunthorpe wrote:
> If the driver doesn't yet support any request driver data it should check
> that it is all zeroed. This is a common pattern, add a helper to do this.
> 
> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
> ---
>  include/rdma/ib_verbs.h | 14 ++++++++++++++
>  1 file changed, 14 insertions(+)
> 
> diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
> index c0dd82a77e7a13..973d9ec6875e63 100644
> --- a/include/rdma/ib_verbs.h
> +++ b/include/rdma/ib_verbs.h
> @@ -3119,6 +3119,20 @@ static inline bool ib_is_udata_cleared(struct ib_udata *udata,
>  	return ib_is_buffer_cleared(udata->inbuf + offset, len);
>  }
>  
> +/**
> + * ib_is_udata_in_empty - Check if the udata is empty
> + * @udata: The system calls ib_udata struct
> + *
> + * This should be used if the driver does not currently define a driver data
> + * struct.
> + */
> +static inline bool ib_is_udata_in_empty(struct ib_udata *udata)
> +{
> +	if (udata && udata->inlen != 0)
> +		return ib_is_buffer_cleared(udata->inbuf, udata->inlen);

The number of existing callers of ib_is_buffer_cleared() and very
similar ib_is_udata_cleared() check caused me to think that udata->inlen
!= 0 needs to be checked in ib_is_buffer_cleared().

For example, we don't have this != 0 check in uverbs_request_finish().

Thanks

> +	return true;
> +}
> +
>  static inline int _ib_copy_validate_udata_in(struct ib_udata *udata, void *req,
>  					     size_t kernel_size,
>  					     size_t minimum_size)
> -- 
> 2.43.0
> 

Re: [PATCH 05/10] RDMA: Provide documentation about the uABI compatibility rules

[Leon Romanovsky]

On Thu, Feb 05, 2026 at 09:45:39PM -0400, Jason Gunthorpe wrote:
> Write down how all of this is supposed to work using the new helpers.
> 
> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
> ---
>  include/rdma/ib_verbs.h | 81 +++++++++++++++++++++++++++++++++++++++++
>  1 file changed, 81 insertions(+)

Can we add these rules to Chris's review-prompts?

Thanks

Re: [PATCH 07/10] RDMA/bnxt_re: Add compatibility checks to the uapi path for no data

[Leon Romanovsky]

On Thu, Feb 05, 2026 at 09:45:41PM -0400, Jason Gunthorpe wrote:
> If drivers ever want to go from an empty drvdata to something with them
> they need to have called ib_is_udata_in_empty(). Add the missing calls to
> all the system calls that don't have req structures.

This is also a good candidate for an AI review prompt.  
It is easy to overlook the need for `ib_is_udata_in_empty()`.

Thanks

> 
> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
> ---
>  drivers/infiniband/hw/bnxt_re/ib_verbs.c | 39 ++++++++++++++++++++++++
>  1 file changed, 39 insertions(+)
> 
> diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> index 2942ff44f6a547..485785fad1df63 100644
> --- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> +++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> @@ -187,6 +187,9 @@ int bnxt_re_query_device(struct ib_device *ibdev,
>  	struct bnxt_re_dev *rdev = to_bnxt_re_dev(ibdev, ibdev);
>  	struct bnxt_qplib_dev_attr *dev_attr = rdev->dev_attr;
>  
> +	if (!ib_is_udata_in_empty(udata))
> +		return -EOPNOTSUPP;
> +
>  	memset(ib_attr, 0, sizeof(*ib_attr));
>  	memcpy(&ib_attr->fw_ver, dev_attr->fw_ver,
>  	       min(sizeof(dev_attr->fw_ver),
> @@ -676,6 +679,9 @@ int bnxt_re_dealloc_pd(struct ib_pd *ib_pd, struct ib_udata *udata)
>  	struct bnxt_re_pd *pd = container_of(ib_pd, struct bnxt_re_pd, ib_pd);
>  	struct bnxt_re_dev *rdev = pd->rdev;
>  
> +	if (!ib_is_udata_in_empty(udata))
> +		return -EOPNOTSUPP;
> +
>  	if (udata) {
>  		rdma_user_mmap_entry_remove(pd->pd_db_mmap);
>  		pd->pd_db_mmap = NULL;
> @@ -703,6 +709,9 @@ int bnxt_re_alloc_pd(struct ib_pd *ibpd, struct ib_udata *udata)
>  	u32 active_pds;
>  	int rc = 0;
>  
> +	if (!ib_is_udata_in_empty(udata))
> +		return -EOPNOTSUPP;
> +
>  	pd->rdev = rdev;
>  	if (bnxt_qplib_alloc_pd(&rdev->qplib_res, &pd->qplib_pd)) {
>  		ibdev_err(&rdev->ibdev, "Failed to allocate HW PD");
> @@ -817,6 +826,9 @@ int bnxt_re_create_ah(struct ib_ah *ib_ah, struct rdma_ah_init_attr *init_attr,
>  	u8 nw_type;
>  	int rc;
>  
> +	if (!ib_is_udata_in_empty(udata))
> +		return -EOPNOTSUPP;
> +
>  	if (!(rdma_ah_get_ah_flags(ah_attr) & IB_AH_GRH)) {
>  		ibdev_err(&rdev->ibdev, "Failed to alloc AH: GRH not set");
>  		return -EINVAL;
> @@ -978,6 +990,9 @@ int bnxt_re_destroy_qp(struct ib_qp *ib_qp, struct ib_udata *udata)
>  	unsigned int flags;
>  	int rc;
>  
> +	if (!ib_is_udata_in_empty(udata))
> +		return -EOPNOTSUPP;
> +
>  	bnxt_re_debug_rem_qpinfo(rdev, qp);
>  
>  	bnxt_qplib_flush_cqn_wq(&qp->qplib_qp);
> @@ -1828,6 +1843,9 @@ int bnxt_re_destroy_srq(struct ib_srq *ib_srq, struct ib_udata *udata)
>  	struct bnxt_re_dev *rdev = srq->rdev;
>  	struct bnxt_qplib_srq *qplib_srq = &srq->qplib_srq;
>  
> +	if (!ib_is_udata_in_empty(udata))
> +		return -EOPNOTSUPP;
> +
>  	if (rdev->chip_ctx->modes.toggle_bits & BNXT_QPLIB_SRQ_TOGGLE_BIT) {
>  		free_page((unsigned long)srq->uctx_srq_page);
>  		hash_del(&srq->hash_entry);
> @@ -1977,6 +1995,9 @@ int bnxt_re_modify_srq(struct ib_srq *ib_srq, struct ib_srq_attr *srq_attr,
>  					       ib_srq);
>  	struct bnxt_re_dev *rdev = srq->rdev;
>  
> +	if (!ib_is_udata_in_empty(udata))
> +		return -EOPNOTSUPP;
> +
>  	switch (srq_attr_mask) {
>  	case IB_SRQ_MAX_WR:
>  		/* SRQ resize is not supported */
> @@ -2093,6 +2114,9 @@ int bnxt_re_modify_qp(struct ib_qp *ib_qp, struct ib_qp_attr *qp_attr,
>  	unsigned int flags;
>  	u8 nw_type;
>  
> +	if (!ib_is_udata_in_empty(udata))
> +		return -EOPNOTSUPP;
> +
>  	if (qp_attr_mask & ~IB_QP_ATTR_STANDARD_BITS)
>  		return -EOPNOTSUPP;
>  
> @@ -3111,6 +3135,9 @@ int bnxt_re_destroy_cq(struct ib_cq *ib_cq, struct ib_udata *udata)
>  	nq = cq->qplib_cq.nq;
>  	cctx = rdev->chip_ctx;
>  
> +	if (!ib_is_udata_in_empty(udata))
> +		return -EOPNOTSUPP;
> +
>  	if (cctx->modes.toggle_bits & BNXT_QPLIB_CQ_TOGGLE_BIT) {
>  		free_page((unsigned long)cq->uctx_cq_page);
>  		hash_del(&cq->hash_entry);
> @@ -4058,6 +4085,9 @@ int bnxt_re_dereg_mr(struct ib_mr *ib_mr, struct ib_udata *udata)
>  	struct bnxt_re_dev *rdev = mr->rdev;
>  	int rc;
>  
> +	if (!ib_is_udata_in_empty(udata))
> +		return -EOPNOTSUPP;
> +
>  	rc = bnxt_qplib_free_mrw(&rdev->qplib_res, &mr->qplib_mr);
>  	if (rc) {
>  		ibdev_err(&rdev->ibdev, "Dereg MR failed: %#x\n", rc);
> @@ -4166,6 +4196,9 @@ struct ib_mw *bnxt_re_alloc_mw(struct ib_pd *ib_pd, enum ib_mw_type type,
>  	u32 active_mws;
>  	int rc;
>  
> +	if (!ib_is_udata_in_empty(udata))
> +		return ERR_PTR(-EOPNOTSUPP);
> +
>  	mw = kzalloc(sizeof(*mw), GFP_KERNEL);
>  	if (!mw)
>  		return ERR_PTR(-ENOMEM);
> @@ -4294,6 +4327,9 @@ struct ib_mr *bnxt_re_reg_user_mr(struct ib_pd *ib_pd, u64 start, u64 length,
>  	struct ib_umem *umem;
>  	struct ib_mr *ib_mr;
>  
> +	if (!ib_is_udata_in_empty(udata))
> +		return ERR_PTR(-EOPNOTSUPP);
> +
>  	if (dmah)
>  		return ERR_PTR(-EOPNOTSUPP);
>  
> @@ -4474,6 +4510,9 @@ struct ib_flow *bnxt_re_create_flow(struct ib_qp *ib_qp,
>  	struct bnxt_re_flow *flow;
>  	int rc;
>  
> +	if (!ib_is_udata_in_empty(udata))
> +		return ERR_PTR(-EOPNOTSUPP);
> +
>  	if (attr->type != IB_FLOW_ATTR_SNIFFER ||
>  	    !rdev->rcfw.roce_mirror)
>  		return ERR_PTR(-EOPNOTSUPP);
> -- 
> 2.43.0
> 
> 

Re: [PATCH 09/10] RDMA/bnxt_re: Use ib_respond_udata()

[Leon Romanovsky]

On Thu, Feb 05, 2026 at 09:45:43PM -0400, Jason Gunthorpe wrote:
> All the calls to ib_copy_to_udata() can use this helper safely.
> 
> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
> ---
>  drivers/infiniband/hw/bnxt_re/ib_verbs.c | 10 +++++-----
>  1 file changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> index 6ea03e1f6c23dd..9d1c31bb994218 100644
> --- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> +++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> @@ -748,7 +748,7 @@ int bnxt_re_alloc_pd(struct ib_pd *ibpd, struct ib_udata *udata)

<...>

> -			rc = ib_copy_to_udata(udata, &resp, sizeof(resp));
> +			rc = ib_respond_udata(udata, resp);
>  			if (rc) {
>  				ibdev_err(&rdev->ibdev, "Failed to copy QP udata");

<...>

> -		rc = ib_copy_to_udata(udata, &resp, sizeof(resp));
> +		rc = ib_respond_udata(udata, resp);
>  		if (rc) {
>  			ibdev_err(&rdev->ibdev, "SRQ copy to udata failed!");

<...>

> -		rc = ib_copy_to_udata(udata, &resp, min(sizeof(resp), udata->outlen));
> +		rc = ib_respond_udata(udata, resp);
>  		if (rc) {
>  			ibdev_err(&rdev->ibdev, "Failed to copy CQ udata");

<...>

> -	rc = ib_copy_to_udata(udata, &resp, min(udata->outlen, sizeof(resp)));
> +	rc = ib_respond_udata(udata, resp);
>  	if (rc) {
>  		ibdev_err(ibdev, "Failed to copy user context");

Should we move the error message into ib_respond_udata() and remove all
the corresponding prints from the drivers?

Thanks

> -- 
> 2.43.0
> 
> 

Re: [PATCH 09/10] RDMA/bnxt_re: Use ib_respond_udata()

[Jason Gunthorpe]

On Fri, Feb 13, 2026 at 12:40:24PM +0200, Leon Romanovsky wrote:

> > -	rc = ib_copy_to_udata(udata, &resp, min(udata->outlen, sizeof(resp)));
> > +	rc = ib_respond_udata(udata, resp);
> >  	if (rc) {
> >  		ibdev_err(ibdev, "Failed to copy user context");
> 
> Should we move the error message into ib_respond_udata() and remove all
> the corresponding prints from the drivers?

There shouldn't be an error message at all. I didn't try to remove
that stuff.

Jason

Re: [PATCH 03/10] RDMA: Add ib_respond_udata()

[Jason Gunthorpe]

On Fri, Feb 13, 2026 at 12:10:53PM +0200, Leon Romanovsky wrote:
> > @@ -3177,6 +3177,38 @@ static inline int _ib_copy_validate_udata_in(struct ib_udata *udata, void *req,
> >  		ret;                                                          \
> >  	})
> >  
> > +static inline int _ib_respond_udata(struct ib_udata *udata, const void *src,
> > +				   size_t len)
> > +{
> > +	size_t copy_len;
> > +
> > +	copy_len = min(len, udata->outlen);
> 
> Don't you need to check that udata->outlen is larger than zero?

As far as I can tell 0 works fine with copy_to_user()

Jason

Re: [PATCH 04/10] RDMA: Add ib_is_udata_in_empty()

[Jason Gunthorpe]

On Fri, Feb 13, 2026 at 12:22:40PM +0200, Leon Romanovsky wrote:
> On Thu, Feb 05, 2026 at 09:45:38PM -0400, Jason Gunthorpe wrote:
> > If the driver doesn't yet support any request driver data it should check
> > that it is all zeroed. This is a common pattern, add a helper to do this.
> > 
> > Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
> > ---
> >  include/rdma/ib_verbs.h | 14 ++++++++++++++
> >  1 file changed, 14 insertions(+)
> > 
> > diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
> > index c0dd82a77e7a13..973d9ec6875e63 100644
> > --- a/include/rdma/ib_verbs.h
> > +++ b/include/rdma/ib_verbs.h
> > @@ -3119,6 +3119,20 @@ static inline bool ib_is_udata_cleared(struct ib_udata *udata,
> >  	return ib_is_buffer_cleared(udata->inbuf + offset, len);
> >  }
> >  
> > +/**
> > + * ib_is_udata_in_empty - Check if the udata is empty
> > + * @udata: The system calls ib_udata struct
> > + *
> > + * This should be used if the driver does not currently define a driver data
> > + * struct.
> > + */
> > +static inline bool ib_is_udata_in_empty(struct ib_udata *udata)
> > +{
> > +	if (udata && udata->inlen != 0)
> > +		return ib_is_buffer_cleared(udata->inbuf, udata->inlen);
> 
> The number of existing callers of ib_is_buffer_cleared() and very
> similar ib_is_udata_cleared() check caused me to think that udata->inlen
> != 0 needs to be checked in ib_is_buffer_cleared().

There is probably something that could be slightly improved here, but
I'm going to leave it for another day.

It should also be using check_zeroed_user() not what it has there..

After my next series there are only two remaining callers of
ib_is_buffer_cleared() and two of ib_is_udata_cleared().

Jason

Re: [PATCH 05/10] RDMA: Provide documentation about the uABI compatibility rules

[Jason Gunthorpe]

On Fri, Feb 13, 2026 at 12:23:47PM +0200, Leon Romanovsky wrote:
> On Thu, Feb 05, 2026 at 09:45:39PM -0400, Jason Gunthorpe wrote:
> > Write down how all of this is supposed to work using the new helpers.
> > 
> > Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
> > ---
> >  include/rdma/ib_verbs.h | 81 +++++++++++++++++++++++++++++++++++++++++
> >  1 file changed, 81 insertions(+)
> 
> Can we add these rules to Chris's review-prompts?

Yes, I was thinking about the same thing, not sure how to do that

Jason

Re: [PATCH 03/10] RDMA: Add ib_respond_udata()

[Leon Romanovsky]

On Fri, Feb 13, 2026 at 08:43:59AM -0400, Jason Gunthorpe wrote:
> On Fri, Feb 13, 2026 at 12:10:53PM +0200, Leon Romanovsky wrote:
> > > @@ -3177,6 +3177,38 @@ static inline int _ib_copy_validate_udata_in(struct ib_udata *udata, void *req,
> > >  		ret;                                                          \
> > >  	})
> > >  
> > > +static inline int _ib_respond_udata(struct ib_udata *udata, const void *src,
> > > +				   size_t len)
> > > +{
> > > +	size_t copy_len;
> > > +
> > > +	copy_len = min(len, udata->outlen);
> > 
> > Don't you need to check that udata->outlen is larger than zero?
> 
> As far as I can tell 0 works fine with copy_to_user()

My main concern that it is not clear what return value will be in that
case.

+       copy_len = min(len, udata->outlen);
+       if (copy_to_user(udata->outbuf, src, copy_len))
+               return -EFAULT; <--- this?
+       if (copy_len < udata->outlen) {
...
+       }
+       return 0; <- or this?

Thanks

> 
> Jason
> 

Re: [PATCH 09/10] RDMA/bnxt_re: Use ib_respond_udata()

[Leon Romanovsky]

On Fri, Feb 13, 2026 at 08:42:32AM -0400, Jason Gunthorpe wrote:
> On Fri, Feb 13, 2026 at 12:40:24PM +0200, Leon Romanovsky wrote:
> 
> > > -	rc = ib_copy_to_udata(udata, &resp, min(udata->outlen, sizeof(resp)));
> > > +	rc = ib_respond_udata(udata, resp);
> > >  	if (rc) {
> > >  		ibdev_err(ibdev, "Failed to copy user context");
> > 
> > Should we move the error message into ib_respond_udata() and remove all
> > the corresponding prints from the drivers?
> 
> There shouldn't be an error message at all. I didn't try to remove
> that stuff.

Please clean this up. People will copy and paste this code, and it is better
to ensure it is properly prepared for future use.

Thanks

> 
> Jason

Re: [PATCH 03/10] RDMA: Add ib_respond_udata()

[Jason Gunthorpe]

On Fri, Feb 13, 2026 at 05:37:39PM +0200, Leon Romanovsky wrote:
> On Fri, Feb 13, 2026 at 08:43:59AM -0400, Jason Gunthorpe wrote:
> > On Fri, Feb 13, 2026 at 12:10:53PM +0200, Leon Romanovsky wrote:
> > > > @@ -3177,6 +3177,38 @@ static inline int _ib_copy_validate_udata_in(struct ib_udata *udata, void *req,
> > > >  		ret;                                                          \
> > > >  	})
> > > >  
> > > > +static inline int _ib_respond_udata(struct ib_udata *udata, const void *src,
> > > > +				   size_t len)
> > > > +{
> > > > +	size_t copy_len;
> > > > +
> > > > +	copy_len = min(len, udata->outlen);
> > > 
> > > Don't you need to check that udata->outlen is larger than zero?
> > 
> > As far as I can tell 0 works fine with copy_to_user()
> 
> My main concern that it is not clear what return value will be in that
> case.
> 
> +       copy_len = min(len, udata->outlen);
> +       if (copy_to_user(udata->outbuf, src, copy_len))
> +               return -EFAULT; <--- this?
> +       if (copy_len < udata->outlen) {
> ...
> +       }
> +       return 0; <- or this?

Oh, yeah, that's a really good point.

Jason

Re: [PATCH 05/10] RDMA: Provide documentation about the uABI compatibility rules

[Leon Romanovsky]

On Fri, Feb 13, 2026 at 08:56:58AM -0400, Jason Gunthorpe wrote:
> On Fri, Feb 13, 2026 at 12:23:47PM +0200, Leon Romanovsky wrote:
> > On Thu, Feb 05, 2026 at 09:45:39PM -0400, Jason Gunthorpe wrote:
> > > Write down how all of this is supposed to work using the new helpers.
> > > 
> > > Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
> > > ---
> > >  include/rdma/ib_verbs.h | 81 +++++++++++++++++++++++++++++++++++++++++
> > >  1 file changed, 81 insertions(+)
> > 
> > Can we add these rules to Chris's review-prompts?
> 
> Yes, I was thinking about the same thing, not sure how to do that

As a start, you can put it into Documentation folder.
Here https://lore.kernel.org/all/20260212124208.187e53ae@kernel.org,
Jakub says that Chris is changing prompts to consult with Documentation/*.

Thanks

> 
> Jason
> 

Re: [PATCH 03/10] RDMA: Add ib_respond_udata()

[Jason Gunthorpe]

On Fri, Feb 13, 2026 at 11:48:13AM -0400, Jason Gunthorpe wrote:
> On Fri, Feb 13, 2026 at 05:37:39PM +0200, Leon Romanovsky wrote:
> > On Fri, Feb 13, 2026 at 08:43:59AM -0400, Jason Gunthorpe wrote:
> > > On Fri, Feb 13, 2026 at 12:10:53PM +0200, Leon Romanovsky wrote:
> > > > > @@ -3177,6 +3177,38 @@ static inline int _ib_copy_validate_udata_in(struct ib_udata *udata, void *req,
> > > > >  		ret;                                                          \
> > > > >  	})
> > > > >  
> > > > > +static inline int _ib_respond_udata(struct ib_udata *udata, const void *src,
> > > > > +				   size_t len)
> > > > > +{
> > > > > +	size_t copy_len;
> > > > > +
> > > > > +	copy_len = min(len, udata->outlen);
> > > > 
> > > > Don't you need to check that udata->outlen is larger than zero?
> > > 
> > > As far as I can tell 0 works fine with copy_to_user()
> > 
> > My main concern that it is not clear what return value will be in that
> > case.
> > 
> > +       copy_len = min(len, udata->outlen);
> > +       if (copy_to_user(udata->outbuf, src, copy_len))
> > +               return -EFAULT; <--- this?
> > +       if (copy_len < udata->outlen) {
> > ...
> > +       }
> > +       return 0; <- or this?
> 
> Oh, yeah, that's a really good point.

So it still returns 0, copy_to_user() returns the number of bytes left
to copy. See Documentation/kernel-hacking/hacking.rst

    Unlike :c:func:`put_user()` and :c:func:`get_user()`, they
    return the amount of uncopied data (ie. 0 still means success).

Number of bytes left to copy for a 0 length copy is still 0, not
EFAULT.

I'm just going to add a comment.

Jason

Re: [PATCH 03/10] RDMA: Add ib_respond_udata()

[Leon Romanovsky]

On Mon, Feb 16, 2026 at 07:14:24PM -0400, Jason Gunthorpe wrote:
> On Fri, Feb 13, 2026 at 11:48:13AM -0400, Jason Gunthorpe wrote:
> > On Fri, Feb 13, 2026 at 05:37:39PM +0200, Leon Romanovsky wrote:
> > > On Fri, Feb 13, 2026 at 08:43:59AM -0400, Jason Gunthorpe wrote:
> > > > On Fri, Feb 13, 2026 at 12:10:53PM +0200, Leon Romanovsky wrote:
> > > > > > @@ -3177,6 +3177,38 @@ static inline int _ib_copy_validate_udata_in(struct ib_udata *udata, void *req,
> > > > > >  		ret;                                                          \
> > > > > >  	})
> > > > > >  
> > > > > > +static inline int _ib_respond_udata(struct ib_udata *udata, const void *src,
> > > > > > +				   size_t len)
> > > > > > +{
> > > > > > +	size_t copy_len;
> > > > > > +
> > > > > > +	copy_len = min(len, udata->outlen);
> > > > > 
> > > > > Don't you need to check that udata->outlen is larger than zero?
> > > > 
> > > > As far as I can tell 0 works fine with copy_to_user()
> > > 
> > > My main concern that it is not clear what return value will be in that
> > > case.
> > > 
> > > +       copy_len = min(len, udata->outlen);
> > > +       if (copy_to_user(udata->outbuf, src, copy_len))
> > > +               return -EFAULT; <--- this?
> > > +       if (copy_len < udata->outlen) {
> > > ...
> > > +       }
> > > +       return 0; <- or this?
> > 
> > Oh, yeah, that's a really good point.
> 
> So it still returns 0, copy_to_user() returns the number of bytes left
> to copy. See Documentation/kernel-hacking/hacking.rst
> 
>     Unlike :c:func:`put_user()` and :c:func:`get_user()`, they
>     return the amount of uncopied data (ie. 0 still means success).
> 
> Number of bytes left to copy for a 0 length copy is still 0, not
> EFAULT.
> 
> I'm just going to add a comment.

It should work as well.

Thanks

> 
> Jason
> 

Re: [PATCH 05/10] RDMA: Provide documentation about the uABI compatibility rules

[Jason Gunthorpe]

On Fri, Feb 13, 2026 at 05:57:31PM +0200, Leon Romanovsky wrote:
> On Fri, Feb 13, 2026 at 08:56:58AM -0400, Jason Gunthorpe wrote:
> > On Fri, Feb 13, 2026 at 12:23:47PM +0200, Leon Romanovsky wrote:
> > > On Thu, Feb 05, 2026 at 09:45:39PM -0400, Jason Gunthorpe wrote:
> > > > Write down how all of this is supposed to work using the new helpers.
> > > > 
> > > > Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
> > > > ---
> > > >  include/rdma/ib_verbs.h | 81 +++++++++++++++++++++++++++++++++++++++++
> > > >  1 file changed, 81 insertions(+)
> > > 
> > > Can we add these rules to Chris's review-prompts?
> > 
> > Yes, I was thinking about the same thing, not sure how to do that
> 
> As a start, you can put it into Documentation folder.
> Here https://lore.kernel.org/all/20260212124208.187e53ae@kernel.org,
> Jakub says that Chris is changing prompts to consult with Documentation/*.

Hmm, well lets put a pin in it for now then, I'm not sure what to do
with that. It probably needs some prompt "if you see these functions
then read the comment above struct ib_udata in ib_uverbs.h and check
it" inside Chris's repo.

Jason